DSPMIncidentList

This automation script manages incidents in a list by adding or deleting incidents based on the provided action. For incidents older than the configured time limit (default is 48 hours), the script performs a cleanup by removing the incident from the list. Additionally, the script supports adding new incidents to the list if they do not already exist.

python · DSPM

Details

ID	`DSPMIncidentList`
Language	python
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

This automation script manages incidents in a list by adding or deleting incidents based on the provided action.
For incidents older than the configured time limit (default is 48 hours), the script performs a cleanup by removing
the incident from the list. Additionally, the script supports adding new incidents to the list if they do not already exist.

Script Data

Name	Description
Script Type	python3
Cortex XSOAR Version	6.10.0

Inputs

Argument Name	Description
incident_data	Incident data of a specific asset.
action	Action to perform on incident list i.e :- add or delete list.
incident_list	DSPM Incident list data.
rerun_time	Re-run time to be checked of an incident to delete or not.

Outputs

Path	Description	Type
listStatus	Updated incident list status.	Unknown

Source

DSPMIncidentList.py DSPMIncidentList_test.py DSPMIncidentList.yml

Download History Raw

from unittest.mock import patch
from DSPMIncidentList import get_incident_time, timeDifferenceInHours, get_incident_list, delete_incident_list, add_incident_list


def test_get_incident_time():
    incident_list = [
        {"incident_id": "1", "incident_created": "2024-11-01T00:00:00Z"},
        {"incident_id": "2", "incident_created": "2024-11-02T00:00:00Z"},
        {"incident_id": "3", "incident_created": "2024-11-03T00:00:00Z"},
    ]
    incident_id = "2"
    result = get_incident_time(incident_list, incident_id)

    # Assert
    assert result == "2024-11-02T00:00:00Z"


def test_timeDifferenceInHours():
    given_timestamp = "2024-11-04 08:00:00.000000"
    rerun_time = 4
    result = timeDifferenceInHours(given_timestamp, rerun_time)
    assert result is True


def test_get_incident_list():
    incident_object = {}
    mock_response = [{"Contents": ["Incident1", "Incident2", "Incident3"]}]

    with patch("DSPMIncidentList.demisto.executeCommand", return_value=mock_response):
        result = get_incident_list(incident_object)

        # Assert
        assert result == ["Incident1", "Incident2", "Incident3"]


def test_delete_incident_list():
    args = {
        "rerun_time": "48",
        "incident_data": {"id": 1},
        "incident_list": '{"incident_id": 1, "incident_created": "2024-01-01T00:00:00Z"}',
    }

    with (
        patch("DSPMIncidentList.get_incident_time", return_value="2024-01-01T00:00:00Z"),
        patch("DSPMIncidentList.timeDifferenceInHours", return_value=True),
    ):
        result = delete_incident_list(args)

        # Assert
        assert result == "Delete incident data with incident id 1 from the list."


def test_add_incident_list():
    args = {
        "incident_data": {"id": "1", "incidentCreated": "2024-11-01T00:00:00Z"},
        "incident_list": '{"incident_id": "2", "incident_created": "2024-11-02T00:00:00Z"}',
    }
    result = add_incident_list(args)

    # Assert
    assert result == "Successfully added incident data with incident id 1 in the list."